SB20260409110 - Multiple vulnerabilities in Apache Tomcat (April 2026 release)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260409110

SB20260409110 - Multiple vulnerabilities in Apache Tomcat (April 2026 release)

Published: April 9, 2026 Updated: April 10, 2026

Security Bulletin ID SB20260409110
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Improper Certificate Validation (CVE-ID: CVE-2026-34500)

The vulnerability allows a remote user to bypass client certificate authentication.

The vulnerability exists due to improper certificate validation in CLIENT_CERT authentication when processing OCSP checks with FFM and soft-fail disabled. A remote user can present a certificate in affected scenarios to bypass client certificate authentication.

Only some scenarios using FFM are affected.


2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-34487)

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log output in the cloud membership for clustering component when writing log messages. A remote attacker can trigger log entries that expose the Kubernetes bearer token to disclose sensitive information.


3) Protection Mechanism Failure (CVE-ID: CVE-2026-34486)

The vulnerability allows a remote attacker to bypass the EncryptInterceptor.

The vulnerability exists due to an implementation error in the EncryptInterceptor when processing traffic protected by the fix for #VU125739 (CVE-2026-29146). A remote attacker can exploit the flawed handling to bypass the EncryptInterceptor.


4) Improper Encoding or Escaping of Output (CVE-ID: CVE-2026-34483)

The vulnerability allows a remote attacker to inject arbitrary JSON into the JSON access log.

The vulnerability exists due to incomplete escaping in the JSON access log when handling requests with non-default Connector attributes relaxedPathChars and/or relaxedQueryChars. A remote attacker can send a specially crafted request to inject arbitrary JSON into the JSON access log.

Only configurations using non-default values for relaxedPathChars and/or relaxedQueryChars are affected.


Remediation

Install update from vendor's website.

References